Today, I stumbled across a recent FBI application and accompanying affidavit for a search warrant ordering Google to unlock a screen-locked Android phone. The application asks Google to: “provide law enforcement with any and all means of gaining access, including login and password information, password reset, and/or manufacturer default code (“PUK”), in order to obtain the complete contents of the memory” of a seized phone.
The phone in question was seized from a gentleman named Dante Dears, a founding member of the “Pimpin’ Hoes Daily” street gang. On January 17, 2012, a cellphone was seized from Dears by an FBI agent, who then obtained a search warrant to look through the device. According to the affidavit, the technicians at the FBI Regional Computer Forensics Lab (RCFL) were unable to get past the electronic “pattern lock” access controls protecting the phone (apparently, entering multiple incorrect unlock sequences will lock the memory of the phone, which can then only be accessed by entering the user’s Gmail username and password).
So why is this interesting and noteworthy?
First, it suggests that the FBI’s computer forensics lab in Southern California is unable, or unwilling to use commercially available forensics tools or widely documented hardware-hacking techniques to analyze seized phones and download the data from them.
Second, it suggests that a warrant might be enough to get Google to unlock a phone. Presumably, this is not the first time that the FBI has requested Google unlock a phone, so one would assume that the FBI would request the right kind of order. However, we do not know if Google has complied with the request. Given that an unlocked smartphone will continue to receive text messages and new emails (transmitted after the device was first seized), one could reasonably argue that the government should have to obtain a wiretap order in order to unlock the phone.
Third, on page 13 of the warrant application, the government asks that the owner of the phone not be told about the government’s request to unlock his phone. It is surprising then that the warrant and the associated affidavit have not been sealed by the court.
I just want to tell anyone who cares, that there are applications out there that will wipe your phone if you enter the wrong password too many times. There are also applications out there that will wipe your phone via text message. But what you need is to be able to control the system functions that will permit a phone to be unlocked, including password reset, puk’s, system level codes, and any data that would allow an unauthorized person to gain access to your phone.
Now, this guy allegedly pimps teenagers, so it’s difficult for me to reach down in my bag of pity and offer him some. But regardless of his crimes, his past, his future or his deplorable nature, without this man having his rights, you wouldn’t have yours either. Oh, that’s right, you don’t. You only have the illusion of rights.
